TCPdump is a powerful command-line packet analyzer, which may be used for analyzing of DNS question/answer process. TCPdump is preinstalled on many linux distributions. For debian it can be installed directly from the debian repository:  apt-get install tcpdump    TCPdump allows write a sniff to file or display it realtime. It provides several ways how to use it for DNS analysis. Now I will write a few examples. Deeper description is at the bottom of the page.       Example 1) Capture DNS on the fly: